ICO consultation on the draft updated data 
sharing code of practice 


Qi Does the updated code adequately explain and advise on the new aspects of 
data protection legislation which are relevant to data sharing? 


© Yes 
O No 


Q2 If not, please specify where improvements could be made. 


Q3 Does the draft code cover the right issues about data sharing? 


© Yes 
© No 


Q4 If no, what other issues would you like to be covered in it? 


Q5 Does the draft code contain the right level of detail? 
© Yes 
© No 


Q6__sIf no, in what areas should there be more detail within the draft code? 


Q7 Has the draft code sufficiently addressed new areas or developments in data 


protection that are having an impact on your organisation’s data sharing 
practices? 


© Yes 
© No 


Q8 If no, please specify what areas are not being addressed, or not being 
addressed in enough detail. 


More could be said on what a data protection by design approach to data sharing should entail. 
Examples and use cases could be added, in particular examples involving privacy enhancing 
technologies. While data controllers still tend to rely upon the traditional ETL model (Extract, Transform, 
Load) to move data from different sources, emerging technological solutions such as virtualisation can 
drastically reduce data movements within and across organisations. Data virtualisation offers data users 
a virtual view of the data and enables them to access and query data in real time without moving or 
copying the data. Certain types of privacy enhancing technologies can also greatly facilitate the 
operationalisation of the principles of confidentiality and accountability in the context of data sharing. 
These are vital for all types of data sharing, including when data is pooled in order to enable multiple 
parties to have access to the data and query it. Creating an audit trail for data sharing and ensuring 


monitoring in real time is essential, as data can change status/risk profile when moving from one 
organisation to another. 


Q9 Does the draft code provide enough clarity on good practice in data sharing? 
© Yes 
© No 


Q10 If no, please indicate the section(s) of the draft code which could be improved, 
and what can be done to make the section(s) clearer. 


Qiii Does the draft code strike the right balance between recognising the benefits of 
sharing data and the need to protect it? 


© Yes 
O No 


Q12 If no, in what way does the draft code fail to strike this balance? 


Q13 Does the draft code cover case studies or data sharing scenarios relevant to 
your organisation? 


© Yes 
© No 


Q1i4 Please provide any further comments or suggestions you may have about the 
draft code. 


A more concrete method to undertake risk assessment in the context of data sharing could 
be very useful for both public and private actors. 


Q15 To what extent do you agree that the draft code is clear and easy to 
understand? 


© Strongly agree 

© Agree 

©) Neither agree nor disagree 
© Disagree 

© Strongly disagree 


Q16 Are you answering as: 
O An individual acting in a private capacity (e.g. someone providing their 
views as a member of the public of the public) 
© An individual acting in a professional capacity 
© On behalf of an organisation 
O Other 


Q17 Please specify 


Q18 Please specify 


Immuta 


Q19 Please specify 


Thank you for taking the time to share your views and experience. 


